CVSS: 8.8EPSS: 11%CPEs: 2EXPL: 1CVE-2021-20173
https://notcve.org/view.php?id=CVE-2021-20173
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values. Netgear Nighthawk R6700 versión 1.0.4.120, contiene una vulnerabilidad de inyección de comandos en la funcionalidad update del dispositivo. Al desencadenar una comprobación de actualización del sistema por medio de la interfaz SOAP, el dispositivo es susc... • https://www.tenable.com/security/research/tra-2021-57 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-45077
https://notcve.org/view.php?id=CVE-2021-45077
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device. Netgear Nighthawk R6700 versión 1.0.4.120, almacena información confidencial en texto plano. Todos los nombres de usuario y las contraseñas de los servicios asociados al dispositivo se almacenan en texto plano en el dis... • https://www.tenable.com/security/research/tra-2021-57 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-45732
https://notcve.org/view.php?id=CVE-2021-45732
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools, a user can reconfigure settings not intended to be manipulated, repackage the configuration, and restore a backup causing these settings to be changed. Netgear Nighthawk R6700 versión 1.0.4.120, usa una credencial ... • https://www.tenable.com/security/research/tra-2021-57 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23147
https://notcve.org/view.php?id=CVE-2021-23147
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication. Netgear Nighthawk R6700 versión 1.0.4.120, no presenta suficientes protecciones para la consola UART. Un actor malicioso con acceso físico al dispositivo puede conectarse al puerto UART por medio de una conexión serie y ejecutar comando... • https://www.tenable.com/security/research/tra-2021-57 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0CVE-2021-45573
https://notcve.org/view.php?id=CVE-2021-45573
26 Dec 2021 — Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6260 before 1.1.0.76, R6800 before 1.2.0.62, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, AC2100 before 1.2.0.62, AC2400 before 1.2.0.62, and AC2600 before 1.2.0.62. Determinados dispositivos NETGEAR están afectados por un desbordamiento del búfer en la región stack de la memoria por parte de un atacante no autenticado. Esto afecta a R6260 versiones anteriores a 1.1... • https://kb.netgear.com/000064095/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0081 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 54EXPL: 0CVE-2021-45656
https://notcve.org/view.php?id=CVE-2021-45656
26 Dec 2021 — Certain NETGEAR devices are affected by server-side injection. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6050 before 1.0.1.26, JR6150 before 1.0.1.26, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.78, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6700v2 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, RBK40 before 2.5.1.16, RBR40 befor... • https://kb.netgear.com/000064066/Security-Advisory-for-Server-Side-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2019-0140 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 0%CPEs: 120EXPL: 0CVE-2021-38516
https://notcve.org/view.php?id=CVE-2021-38516
11 Aug 2021 — Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1.0.0.52, D7800 before 1.0.1.44, D8500 before 1.0.3.43, DC112A before 1.0.0.40, DGN2200v4 before 1.0.0.108, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, RBS50 before 2.3.0.32, RBK20 before 2.3.0.28, RBR20 before 2.3.0.28, RBS20 before 2.3.0.28, RBK40 before 2.3.0.28, RBR40 before 2.3.0.28, RBS40 before 2.3.0.28, R6020 before 1.0.0.34, R6080 before 1... • https://kb.netgear.com/000063780/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2020-0273 •
CVSS: 7.2EPSS: 0%CPEs: 12EXPL: 0CVE-2021-38520
https://notcve.org/view.php?id=CVE-2021-38520
11 Aug 2021 — Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52, R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, and R7000P before 1.3.2.124. Determinados dispositivos NETGEAR están afectados por una inyección de comandos por un usuario autenticado. Esto afecta a R6400 versiones anteriores a 1.0.1.52, R6400v2 versiones anteriores a 1.0.4.84, R6700v3 versiones anteriores a 1.0.4.84, R6700v2 versiones an... • https://kb.netgear.com/000063763/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0565 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-38525
https://notcve.org/view.php?id=CVE-2021-38525
11 Aug 2021 — Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6200 before 1.1.00.36, D7000 before 1.0.1.70, EX6200v2 before 1.0.1.78, EX7000 before 1.0.1.78, EX8000 before 1.0.1.186, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.42, R6050 before 1.0.1.18, R6080 before 1.0.0.42, R6120 before 1.0.0.46, R6220 before 1.1.0.80, R6260 before 1.1.0.64, R6300v2 before 1.0.4.34, R6700 before 1.0.2.6, R6... • https://kb.netgear.com/000063759/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2018-0378 • CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 24EXPL: 0CVE-2021-38531
https://notcve.org/view.php?id=CVE-2021-38531
11 Aug 2021 — Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, and AC2400 before 1.2.0.76. Determinados dispositivos NETGEAR están afectados por una configuración incorrecta de los ajustes de seguridad. Esto afecta a ... • https://kb.netgear.com/000063769/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2019-0113 •